CVE-2019-13574

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

• CWE-78

• https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/Exploit, Third Party Advisory
• https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851Patch, Third Party Advisory
• https://github.com/minimagick/minimagick/compare/d484786...293f9bbPatch, Third Party Advisory
• https://github.com/minimagick/minimagick/releases/tag/v4.9.4Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html
• https://seclists.org/bugtraq/2019/Jul/20Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4481Third Party Advisory
• https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/Exploit, Third Party Advisory
• https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851Patch, Third Party Advisory
• https://github.com/minimagick/minimagick/compare/d484786...293f9bbPatch, Third Party Advisory
• https://github.com/minimagick/minimagick/releases/tag/v4.9.4Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html
• https://seclists.org/bugtraq/2019/Jul/20Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4481Third Party Advisory

Published

Jul 12, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13569A SQL injection vulnerability exists in the Icegram Email Su…
• CVE-2019-1357A spoofing vulnerability exists when Microsoft Browsers impr…4.3
• CVE-2019-13570The AJdG AdRotate plugin before 5.3 for WordPress allows SQL…
• CVE-2019-13571A SQL injection vulnerability exists in the Vsourz Digital A…9.8
• CVE-2019-13572The Adenion Blog2Social plugin through 5.5.0 for WordPress a…9.8
• CVE-2019-13573A SQL injection vulnerability exists in the FolioVision FV F…9.8
• CVE-2019-13575A SQL injection vulnerability exists in WPEverest Everest Fo…9.8
• CVE-2019-13577SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has …
• CVE-2019-13578A SQL injection vulnerability exists in the Impress GiveWP G…9.8
• CVE-2019-1358A remote code execution vulnerability exists when the Window…7.8
• CVE-2019-13581An issue was discovered in Marvell 88W8688 Wi-Fi firmware be…9.8
• CVE-2019-13582An issue was discovered in Marvell 88W8688 Wi-Fi firmware be…9.8